Metabase Zero-Day SQL Injection Exploited Against Framework, Tally
August 11, 2026
Metabase confirmed an exploited CVSS 10.0 zero-day SQL injection vulnerability that let attackers access customer data at Framework, Tally, and
Cybersecurity
Metabase Zero-Day SQL Injection Exploited Against Framework, Tally
Metabase confirmed an exploited CVSS 10.0 zero-day SQL injection vulnerability that let attackers access customer data at Framework, Tally, and LexisNexis.
Attackers Reach Managed Endpoints as N-able Ships N-central Hotfix 2
Attackers who compromised N-able N-central reached managed endpoints and installed Cloudflare Tunnel persistence, prompting the vendor to release Hotfix 2.
CISA Adds Exploited Kemp LoadMaster Command Injection to KEV
CISA added exploited Progress Kemp LoadMaster command injection CVE-2026-8037 to its KEV catalog after 792 in-the-wild exploitation attempts were documented.
Atlassian Rovo One-Click Flaw Exposes Jira, Confluence Data
Varonis and PromptArmor disclosed prompt-injection flaws in Atlassian Rovo that can exfiltrate Jira, Confluence, and SharePoint data from enterprise tenants.
CSS Attacks Break Webmail Boundaries to Capture Passwords, Tokens
PortSwigger researcher Gareth Heyes showed email-borne CSS attacks that capture passwords and steal tokens in Outlook, Gmail, Yahoo, and other webmail services.
Head Mare Breaches TrueConf Servers, Trojanizes Client Installers
Head Mare hacktivists exploited TrueConf servers and replaced client installers with backdoored versions carrying PhantomCore and PhantomGraph backdoors.
Belgian Connective eID Flaws Let Websites Forge Signatures
Researcher James Arnott disclosed severe flaws in the Connective eID extension exposing PINs, enabling forged signatures, and allowing drive-by code execution.
Solidity Pro VS Code Extensions Steal Wallets, API Keys From Devs
Yeeth Security flagged malicious Solidity Pro VS Code extensions that steal crypto wallets, API keys, and developer credentials, exfiltrating them via Telegram.
OpenAI Pauses Astra Work After Evaluation Flags Cyber Capabilities
OpenAI paused internal work on its Astra model after an evaluation found cyber capabilities that may reach a Critical rating under its preparedness framework.
AitM Phishing Campaign Steals Microsoft 365 Finance Emails
Arctic Wolf documented an AitM phishing campaign hijacking Microsoft 365 accounts to collect payroll and finance emails across North America and Europe.
Attackers Reach Managed Endpoints as N-able Ships N-central Hotfix 2
August 11, 2026
Attackers who compromised N-able N-central reached managed endpoints and installed Cloudflare Tunnel persistence, prompting the vendor to release Hotfix 2.
CISA Adds Exploited Kemp LoadMaster Command Injection to KEV
August 11, 2026
CISA added exploited Progress Kemp LoadMaster command injection CVE-2026-8037 to its KEV catalog after 792 in-the-wild exploitation attempts were documented.
Atlassian Rovo One-Click Flaw Exposes Jira, Confluence Data
August 11, 2026
Varonis and PromptArmor disclosed prompt-injection flaws in Atlassian Rovo that can exfiltrate Jira, Confluence, and SharePoint data from enterprise tenants.
CSS Attacks Break Webmail Boundaries to Capture Passwords, Tokens
August 11, 2026
PortSwigger researcher Gareth Heyes showed email-borne CSS attacks that capture passwords and steal tokens in Outlook, Gmail, Yahoo, and other
Head Mare Breaches TrueConf Servers, Trojanizes Client Installers
August 11, 2026
Head Mare hacktivists exploited TrueConf servers and replaced client installers with backdoored versions carrying PhantomCore and PhantomGraph backdoors.
Belgian Connective eID Flaws Let Websites Forge Signatures
August 11, 2026
Researcher James Arnott disclosed severe flaws in the Connective eID extension exposing PINs, enabling forged signatures, and allowing drive-by code
Solidity Pro VS Code Extensions Steal Wallets, API Keys From Devs
August 11, 2026
Yeeth Security flagged malicious Solidity Pro VS Code extensions that steal crypto wallets, API keys, and developer credentials, exfiltrating them
OpenAI Pauses Astra Work After Evaluation Flags Cyber Capabilities
August 11, 2026
OpenAI paused internal work on its Astra model after an evaluation found cyber capabilities that may reach a Critical rating
AitM Phishing Campaign Steals Microsoft 365 Finance Emails
August 7, 2026
Arctic Wolf documented an AitM phishing campaign hijacking Microsoft 365 accounts to collect payroll and finance emails across North America
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.